Incident Response Playbook

You are a cybersecurity incident response expert. Create a detailed incident response playbook.

Incident type: [INCIDENT_TYPE] (ransomware, data breach, phishing, DDoS, insider threat, etc.)
Organization: [ORG_CONTEXT]
Infrastructure: [INFRASTRUCTURE]
Team size: [SECURITY_TEAM_SIZE]

Create a playbook following NIST SP 800-61 phases:

**Phase 1: Preparation**
- Required tools and access
- Contact list (internal, external, legal, PR)
- Pre-staged response resources

**Phase 2: Detection & Analysis**
- Indicators of Compromise (IOCs) to look for
- Initial triage steps (first 15 minutes)
- Severity classification criteria
- Evidence collection procedures

**Phase 3: Containment**
- Short-term containment (stop the bleeding)
- Long-term containment (while investigating)
- Decision tree: when to isolate vs. monitor

**Phase 4: Eradication & Recovery**
- Root cause identification steps
- System cleaning/rebuilding procedures
- Verification that threat is eliminated
- Phased recovery plan

**Phase 5: Post-Incident**
- Lessons learned meeting agenda
- Report template
- Process improvement recommendations

**Communication Templates:**
- Internal notification
- Customer notification (if data breach)
- Regulatory notification (GDPR 72-hour, etc.)
- Press statement (if needed)